search

cryptosharks131 / lndg

Lite GUI web interface to analyze lnd data and leverage the backend database for automation tools around rebalancing and other basic maintenance tasks.
MIT License
231 stars 47 forks source link

Code Injection in Peer Alias #363

Closed schulzemic closed 1 month ago

schulzemic commented 10 months ago

I have a channel with a node that has the following alias: <script>alert(\"LDK\");</script>

On the lndg overview page, the alias field just remains empty. But when I click on the channel ID in the list of active channels, an alert pops up.

JaviLib commented 2 months ago

I accidentally created a duplicate: https://github.com/cryptosharks131/lndg/issues/394 Anyway mine is better explained with images.

Almost 9 months after this, we are still waiting for a patch. This software seems to be adandonware at this point.

SkanderHelali commented 2 months ago

Almost 9 months after this, we are still waiting for a patch. This software seems to be adandonware at this point.

Have you submitted a pull request with a fix that wasn't merged? No?

cryptosharks131 commented 2 months ago

This should now be resolved in the latest v1.9.0 branch. Can you verify if you are still able to replicate the issue with this branch?

JaviLib commented 1 month ago

It is not solved:

imagen

LNDg v1.9.0

cryptosharks131 commented 1 month ago

For now, focused on the alert that is generated from the example script execution but not that it is still displayed properly.

Do you also still see the alert being generated?

JaviLib commented 1 month ago

No, the alert in the channel is not happening anymore.